8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33245

CVE-2026-33245: React Router vulnerable to XSS in unstable RSC redirect handling via javascript: redirect targets

React Router is a router for React. In versions 7.7.0 through 7.13.1, when using React Router's unstable React Server Components (RSC) APIs, there is a potential client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This does not impact applications that are not using the unstable RSC APIs in React Router. This is patched in version 7.13.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33245

CVE-2026-33245:

8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
react-router	npm	>= 7.7.0, < 7.13.2	7.13.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cross-site scripting (XSS) issue in the unstable React Server Components (RSC) redirect handling of React Router. The advisory states the patched version is 7.13.2. The changelog for this version points to pull request #14882, which contains the fix. The associated commit 52abfffce11ba3cf3b6ba86a72e95954dd790513 modifies packages/react-router/lib/rsc/browser.tsx. The changes are within the createCallServer function, which processes server-sent data for RSC. The patch introduces a check to validate the protocol of redirect URLs before they are assigned to window.location.href. This prevents the execution of javascript: URLs. The vulnerable function is identified as createCallServer because it contains the logic that processes the untrusted redirect location from the server and performs the client-side redirect without proper validation.

Vulnerable functions

createCallServer

packages/react-router/lib/rsc/browser.tsx

The `createCallServer` function is responsible for handling server responses in the experimental React Server Components (RSC) feature of React Router. When a redirect response is received from the server, the function would directly use the provided location in `window.location.href`. This created an XSS vulnerability because a malicious server could provide a `javascript:` URL, which would then be executed in the context of the user's browser. The patch adds a validation step using `hasInvalidProtocol` to ensure the redirect URL does not use a dangerous protocol before performing the redirect.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.